[t] SAAM: Structural Analysis Attack on MUX-based locking

[1]
Locked netlist \(Net\) 
Extracted key \(E\)  where \(\forall {e}\in {\lbrace 0, 1, X\rbrace }\) 
\(E \leftarrow \lbrace \emptyset \rbrace \) 
\(i = 0\)  to \({K}\) 
\(\lbrace n_{1}, n_{2}\rbrace  \leftarrow \)  ExtractDirectInputsOfMUX(\(Net\) , \(K[i]\) )
(OutSize(\(n_{1}\) ) > 1)\(~\wedge ~\) (OutSize(\(n_{2}\) ) > 1)
\(E[i] \leftarrow {X}\) Set unknown value
OutSize(\(n_{1}\) ) == 1
\(E[i] \leftarrow \)  ValueOfKeyForMUXInput(\(n_{1}\) )Out of \(n_{1}\)  is true wire
\(E[i] \leftarrow \)  ValueOfKeyForMUXInput(\(n_{2}\) )Out of \(n_{2}\)  is true wire
return \(E\) 


Interestingly, previous works showcase MUX-based LL including similar examples without noticing this vulnerability [1]}, [2]}, [3]}. The authors in [4]} briefly mention that this might be the reason why SWEEP is effective against MUX-based LL.
